In particular, this is paired with an atomic_store_rel_ptr a few lines below. I think in practice this is probably a no-op as any dependent memory accesses are reads of data that vcpu points to, and if you had a mispredicted read it would never dereference a "wrong" pointer, it would just see a NULL pointer and stop once speculation ran into a fault. That said, I do think this is more correct.

In D47306#1078749, @jhb wrote:

In particular, this is paired with an atomic_store_rel_ptr a few lines below. I think in practice this is probably a no-op as any dependent memory accesses are reads of data that vcpu points to, and if you had a mispredicted read it would never dereference a "wrong" pointer, it would just see a NULL pointer and stop once speculation ran into a fault. That said, I do think this is more correct.

This is perhaps a use-case for atomic_load_consume_ptr()? I think I agree that an acq fence is not formally required, but it looks wrong at first glance.